[PATCH 21.11 4/4] net/hns3: fix crash for NEON and SVE

[Huisong Li]

[ upstream commit 01843ab2f2fc8c3137258ec39b2cb6f62ba7b8a2 ]

Driver may fail to allocate bulk mbufs for Neon and SVE when rearm
mbuf. Currently, driver keeps going to handle packets even if there
isn't available descriptors to receive packets at this moment.
As a result, driver probably fills the mbufs with invalid data to
application and accesses to illegal address because of the VLD bit
of the descriptor at the "rx_rearm_start" position still being set.
So driver has to clear VLD bit for this descriptor in this scenario
in case of receiving packets later.

In addition, it is possible that the sum of the "rx_rearm_nb" and
"rx_rearm_start" is greater than total descriptor number of Rx queue
in the above scenario. So the index of rxq->sw_ring[] to set mbuf
pointer to NULL should also be fixed to avoid out-of-bounds memory
access.

Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx")
Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset")

Signed-off-by: Huisong Li <lihuisong at huawei.com>
---
 drivers/net/hns3/hns3_rxtx.c         | 2 +-
 drivers/net/hns3/hns3_rxtx_vec.c     | 5 +++++
 drivers/net/hns3/hns3_rxtx_vec_sve.c | 5 +++++
 3 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c
index 00f71b43cc..906e73387a 100644
--- a/drivers/net/hns3/hns3_rxtx.c
+++ b/drivers/net/hns3/hns3_rxtx.c
@@ -51,7 +51,7 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq)
 			}
 		}
 		for (i = 0; i < rxq->rx_rearm_nb; i++)
-			rxq->sw_ring[rxq->rx_rearm_start + i].mbuf = NULL;
+			rxq->sw_ring[(rxq->rx_rearm_start + i) % rxq->nb_rx_desc].mbuf = NULL;
 	}
 
 	for (i = 0; i < rxq->bulk_mbuf_num; i++)
diff --git a/drivers/net/hns3/hns3_rxtx_vec.c b/drivers/net/hns3/hns3_rxtx_vec.c
index 153866cf03..5c172b1abf 100644
--- a/drivers/net/hns3/hns3_rxtx_vec.c
+++ b/drivers/net/hns3/hns3_rxtx_vec.c
@@ -66,6 +66,11 @@ hns3_rxq_rearm_mbuf(struct hns3_rx_queue *rxq)
 
 	if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep,
 					  HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) {
+		/*
+		 * Clear VLD bit for the first descriptor rearmed in case
+		 * of going to receive packets later.
+		 */
+		rxdp[0].rx.bd_base_info = 0;
 		rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++;
 		return;
 	}
diff --git a/drivers/net/hns3/hns3_rxtx_vec_sve.c b/drivers/net/hns3/hns3_rxtx_vec_sve.c
index f09a81dbd5..abab91c4ab 100644
--- a/drivers/net/hns3/hns3_rxtx_vec_sve.c
+++ b/drivers/net/hns3/hns3_rxtx_vec_sve.c
@@ -248,6 +248,11 @@ hns3_rxq_rearm_mbuf_sve(struct hns3_rx_queue *rxq)
 
 	if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep,
 					  HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) {
+		/*
+		 * Clear VLD bit for the first descriptor rearmed in case
+		 * of going to receive packets later.
+		 */
+		rxdp[0].rx.bd_base_info = 0;
 		rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++;
 		return;
 	}
-- 
2.33.0